Extract some fields from json and assing to a root

Elastic Stack Beats
1

Hi all,
i've in a log file a series of JSON that i want to parse not to extarct all the fields but only some.

This is my log

    {
        "call_type": "Example", 
        "begin_time": "2020-04-15T15:05:32.982520+00:00",
        "call_size": 30,  
        "caller_id": "123",
        "end_time": "2020-04-15T15:05:32.982744+00:00", 
        "http_method": "POST",  
        "request_id": "444"
     }

and what i want to have is inside a field of mine my_obj i want to keep the whole json inside message and extract some fields to go under my_obj.<field> such as caller_id

    {
        "my_obj" : 
         { 
            "message" : 
             {
              "call_type": "Example", 
              "begin_time": "2020-04-15T15:05:32.982520+00:00",
              "call_size": 30,  
              "caller_id": "123",
              "end_time": "2020-04-15T15:05:32.982744+00:00", 
              "http_method": "POST",  
              "request_id": "444" 
             },
           "request_id": "444",
           "caller_id": "123"
         }
    }

how can I do this? Is it feasible?

2

Yes, this should be possible.

Initially, your entire JSON log entry will start out as a string in the message field. Use the decode_json_fields processor to decode this as JSON into my_obj.message.

Then, you can extract specific fields from my_obj.message.* to my_obj.* using the rename processor.

Hope that helps,

Shaunak

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.